3 ms·

How is this superior to clevis? https://blog.dowhile0.org/2017/10/18/automatic-luks-volumes-unlocking-using-a-tpm2-chip/ https://blog.dowhile0.org/2017/10/18/au

• ae5hnw5 6y ago
  Superior might be a stretch, but it the ability to use PKCS11 and FIDO2 tokens look to be differentiating features.
• vaduz 6y ago
  It enables you to use a token that is portable and removable, which TPM2 chips are not. This has an advantage that it can be carried and secured separately, even if the device has to go into insecure storage like a hotel safe. You need to trust your FIDO2/PKCS11 device to be secure, though. Clevis, on the other hand, allows to bind the key to a specific machine, preventing the storage itself from being yanked out (where it is still possible) - and you need to trust TPM2, which many do not. It's all about trade-offs and trust.